Power System L1022 9786 22H Firmware
Monthly
IBM PowerVM Hypervisor across four active firmware release trains is vulnerable to arbitrary Hostboot memory read and write via the FSP service processor mailbox interface, enabling compromise of the entire host firmware boot stack and the hypervisor subsequently loaded from it. An authenticated attacker holding FSP service-level credentials can send a specially crafted mailbox message that triggers an out-of-bounds memory operation (CWE-125), achieving full confidentiality, integrity, and availability impact against the managed POWER-series system. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the scope change to the hypervisor layer makes this a critical risk for IBM POWER environments with shared or exposed FSP credentials.
Arbitrary code execution on IBM Power host systems is possible when an attacker with service processor access supplies a maliciously crafted firmware update image that bypasses boot-time image validation. Affected firmware versions span three release trains: FW1120.00, FW1110.00-FW1110.30, and FW1060.00-FW1060.80. Exploitation yields full confidentiality, integrity, and availability impact on the host, with scope change indicating the compromise extends beyond the service processor itself. No public exploit or CISA KEV listing is identified at this time.
Privilege escalation in IBM OpenBMC firmware allows any authenticated ReadOnly user to grant themselves full administrator access over the BMC interface on affected IBM Power Systems servers. The flaw spans two firmware release trains - FW1110.00 through FW1110.20 and FW1060.00 through FW1060.71 - across more than a dozen IBM Power9 and Power10 server models. No public exploit code or active exploitation has been identified; EPSS is 0.17% (7th percentile) and SSVC classifies exploitation as none, but the consequence of BMC administrator access is severe given the out-of-band control it provides over physical infrastructure.
A limited out-of-bounds memory read in the host-facing BMC firmware management service of IBM OpenBMC can be triggered by a host system to crash that service and read a small amount of BMC internal memory, producing low confidentiality and availability impact (CVSS 3.4). Only agents who already hold high-privileged control of the managed host can reach the vulnerable interface, since the flaw sits on the local host-to-BMC path (AV:L, PR:H) rather than on the network. Affected firmware levels are FW1060.00 through FW1060.81, FW1110.00 through FW1110.31, and FW1120.00 through FW1120.01; there is no public exploit code identified and no confirmed active exploitation (not in CISA KEV), so the practical risk is low and is largely contingent on the host already being compromised at a privileged level.
Improper handling of sensitive data in the IBM PowerVM Hypervisor partition resource dump interface allows an authenticated administrator on the Hardware Management Console (HMC) or the Power service processor to obtain a limited snapshot of partition processor state, resulting in a confidentiality exposure on the managed system. Affected firmware spans the FW1120.00-FW1120.01, FW1110.00-FW1110.31, FW1060.00-FW1060.81 and FW950.00-FW950.H3 branches. Exploitation requires administrator-level credentials and adjacent-network reachability to the management plane (CVSS 3.1 base score 3.4, vector AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N); there is no public exploit identified at time of analysis, and the practical risk is low because the prerequisite privileged management access is itself a strong barrier and the disclosure is limited in scope.
Local root access inside a guest logical partition (LPAR) on IBM PowerVM systems running affected partition firmware allows an attacker to send a crafted request to the partition firmware runtime and crash it, with possible memory corruption. Rated CVSS 5.1 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H), the flaw affects firmware lines FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81 and FW950.00 through FW950.H3; no public exploit has been identified at time of analysis, and the realistic outcome is denial of service to the partition firmware runtime rather than confirmed cross-partition code execution. The guest-root prerequisite makes this a bounded, low-priority risk relevant mainly to multi-tenant or compromised LPARs on shared Power hardware.
Root-level attackers inside an IBM PowerVM logical partition can corrupt the partition firmware runtime boot configuration stored in NVRAM, leaving that partition unable to boot until an operator manually deletes and recreates the partition configuration. The issue affects PowerVM firmware levels FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3, and requires pre-existing root privileges within the target partition (CVSS 3.1 AV:L/PR:H, base score 5.1) with no remote or unauthenticated path to exploitation. There is no public exploit identified at time of analysis and no confirmed active exploitation; the practical risk is post-compromise sabotage or persistence against the attacker's own partition rather than an initial-access vector.
Denial of service in IBM PowerVM Hypervisor firmware affects logical partitions running affected FW1120, FW1110, FW1060, or FW950 levels: an attacker who already holds root inside an LPAR can send a crafted RTAS firmware-to-OS request and crash that partition, making it unavailable. The vulnerability is local-only, requires high privileges, and is contained to the attacker's partition, so other LPARs on the same managed system are not affected. No public exploit was identified at time of analysis, and the CVSS 3.1 score is 5.1 (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).
Credential exposure in IBM OPENBMC firmware allows administrative users to view passwords logged from resource dump requests. Affected firmware versions FW1110.00 through FW1110.20 and FW1060.00 through FW1060.71 store passwords supplied during resource dump operations in the BMC audit log, where they are accessible to users with administrative privileges. No active exploitation or public exploits have been identified.
IBM PowerVM Hypervisor across four active firmware release trains is vulnerable to arbitrary Hostboot memory read and write via the FSP service processor mailbox interface, enabling compromise of the entire host firmware boot stack and the hypervisor subsequently loaded from it. An authenticated attacker holding FSP service-level credentials can send a specially crafted mailbox message that triggers an out-of-bounds memory operation (CWE-125), achieving full confidentiality, integrity, and availability impact against the managed POWER-series system. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the scope change to the hypervisor layer makes this a critical risk for IBM POWER environments with shared or exposed FSP credentials.
Arbitrary code execution on IBM Power host systems is possible when an attacker with service processor access supplies a maliciously crafted firmware update image that bypasses boot-time image validation. Affected firmware versions span three release trains: FW1120.00, FW1110.00-FW1110.30, and FW1060.00-FW1060.80. Exploitation yields full confidentiality, integrity, and availability impact on the host, with scope change indicating the compromise extends beyond the service processor itself. No public exploit or CISA KEV listing is identified at this time.
Privilege escalation in IBM OpenBMC firmware allows any authenticated ReadOnly user to grant themselves full administrator access over the BMC interface on affected IBM Power Systems servers. The flaw spans two firmware release trains - FW1110.00 through FW1110.20 and FW1060.00 through FW1060.71 - across more than a dozen IBM Power9 and Power10 server models. No public exploit code or active exploitation has been identified; EPSS is 0.17% (7th percentile) and SSVC classifies exploitation as none, but the consequence of BMC administrator access is severe given the out-of-band control it provides over physical infrastructure.
A limited out-of-bounds memory read in the host-facing BMC firmware management service of IBM OpenBMC can be triggered by a host system to crash that service and read a small amount of BMC internal memory, producing low confidentiality and availability impact (CVSS 3.4). Only agents who already hold high-privileged control of the managed host can reach the vulnerable interface, since the flaw sits on the local host-to-BMC path (AV:L, PR:H) rather than on the network. Affected firmware levels are FW1060.00 through FW1060.81, FW1110.00 through FW1110.31, and FW1120.00 through FW1120.01; there is no public exploit code identified and no confirmed active exploitation (not in CISA KEV), so the practical risk is low and is largely contingent on the host already being compromised at a privileged level.
Improper handling of sensitive data in the IBM PowerVM Hypervisor partition resource dump interface allows an authenticated administrator on the Hardware Management Console (HMC) or the Power service processor to obtain a limited snapshot of partition processor state, resulting in a confidentiality exposure on the managed system. Affected firmware spans the FW1120.00-FW1120.01, FW1110.00-FW1110.31, FW1060.00-FW1060.81 and FW950.00-FW950.H3 branches. Exploitation requires administrator-level credentials and adjacent-network reachability to the management plane (CVSS 3.1 base score 3.4, vector AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N); there is no public exploit identified at time of analysis, and the practical risk is low because the prerequisite privileged management access is itself a strong barrier and the disclosure is limited in scope.
Local root access inside a guest logical partition (LPAR) on IBM PowerVM systems running affected partition firmware allows an attacker to send a crafted request to the partition firmware runtime and crash it, with possible memory corruption. Rated CVSS 5.1 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H), the flaw affects firmware lines FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81 and FW950.00 through FW950.H3; no public exploit has been identified at time of analysis, and the realistic outcome is denial of service to the partition firmware runtime rather than confirmed cross-partition code execution. The guest-root prerequisite makes this a bounded, low-priority risk relevant mainly to multi-tenant or compromised LPARs on shared Power hardware.
Root-level attackers inside an IBM PowerVM logical partition can corrupt the partition firmware runtime boot configuration stored in NVRAM, leaving that partition unable to boot until an operator manually deletes and recreates the partition configuration. The issue affects PowerVM firmware levels FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3, and requires pre-existing root privileges within the target partition (CVSS 3.1 AV:L/PR:H, base score 5.1) with no remote or unauthenticated path to exploitation. There is no public exploit identified at time of analysis and no confirmed active exploitation; the practical risk is post-compromise sabotage or persistence against the attacker's own partition rather than an initial-access vector.
Denial of service in IBM PowerVM Hypervisor firmware affects logical partitions running affected FW1120, FW1110, FW1060, or FW950 levels: an attacker who already holds root inside an LPAR can send a crafted RTAS firmware-to-OS request and crash that partition, making it unavailable. The vulnerability is local-only, requires high privileges, and is contained to the attacker's partition, so other LPARs on the same managed system are not affected. No public exploit was identified at time of analysis, and the CVSS 3.1 score is 5.1 (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).
Credential exposure in IBM OPENBMC firmware allows administrative users to view passwords logged from resource dump requests. Affected firmware versions FW1110.00 through FW1110.20 and FW1060.00 through FW1060.71 store passwords supplied during resource dump operations in the BMC audit log, where they are accessible to users with administrative privileges. No active exploitation or public exploits have been identified.